feat(credentials): the certificate keeps its wallet offer link while the offer is open

[rubenvdlinde]

credential-wallet-offer-for-the-learner, the backend and the portal column. The learner section on the certificate page waits (see below).

What changes

• Credential 0.3.5 (register 0.41.1, entity 0.24.1, app version raised so an upgrade imports it): walletOfferUri, the link a wallet app opens.
  • offer() stores integriq's offerUrl (openid-credential-offer://?credential_offer_uri=..., the same value as qrPayload), or builds that link from credentialOfferUri when offerUrl is missing. A failed offer clears it.
  • A claim clears it. A revocation clears it too, even when integriq could not be told.
• Setup check WalletOfferTokenCheck: the admin overview names learniq.openconnector_api_token while it is empty. It warns once an offer has failed on the missing token, and is only a note before any offer was tried, so a school without wallets is not nagged.
• Participant portal, "My certificates": a qr column "Wallet" with the link "Add to wallet" (portaliq link-field-qr-code T10). A link column cannot carry it, because portaliq follows only http(s) and site links there. linkLabel is now a translated manifest key.
• Strings in en and nl.

Spec amended

The change said to store credentialOfferUri. In integriq's EudiWalletController::createOffer that is the offer's JSON address. The link a wallet opens is offerUrl, which the design (D1) meant. The spec now names offerUrl.

Not in this PR

Tasks 2.x and 4.x, the learner's section on CredentialDetail. Board LqLlCertificaat (named in #1892) draws the learner's own certificate page with "Naar wallet" and "Nieuwe code maken". That is the learner starting an offer, which design D2 rules out (the holder has no update right; a learner route with system rights would be a write bypass). This needs a decision before the UI is built.

Verification (on 2769da5)

• PHPUnit: tests/Unit/Service 811, Portal 165, Settings 443, Listener 659, Lifecycle 369, Register 119, AppInfo 18, SetupCheck 3, all OK. New: CredentialWalletOfferUriRegisterTest validates a training-set credential with the real link against the shipped fragment with Opis; WalletOfferTokenCheckTest.
• php -l, phpcs (no errors), phpstan, phpmd (empty HOME), psalm --threads=1 on the changed files: exit 0. validate-register, check-l10n-parity --ratchet, check-schema-l10n (2151, at baseline): pass.
• Hydra gates: 9 failures, all inherited. Whole-tree findings in files this PR does not touch, plus gate 64 (no AppHost autoload prelude in Application.php, a file this PR touches but not on that line). Gate 101 names ConferenceInvitation and WerkprocesProgress, not credential. composer check:strict was not run locally; CI is the full check.

This PR was prepared with AI assistance (Claude Code).

[github-actions]

Quality Report — ConductionNL/learniq @ 0a8c1ff

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 110/110
npm			✅	✅ 747/747
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					❌ 3381/3381 · 5 skipped (no test failed, the job failed for another reason — see its log)
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-10-15 19:37 UTC

Download the full PDF report from the workflow artifacts.